Translate the Joel Test to DFIR / threat intel

[krmaxwell]

http://www.joelonsoftware.com/articles/fog0000000043.html

[sroberts]

Awwwww that'd be sick!

[krmaxwell]

So what would go into an equivalent sloppy test to measure the maturity of a threat intel program? For starters:

• Do you capture all your IR reports into a central repository for review?
• Do you extract intelligence at all appropriate levels (strategic, operational, tactical) from your own incidents?
• Have you defined intelligence requirements based on the needs of your organization and sector?

Relevant: http://ryanstillions.blogspot.com/2014/04/the-dml-model_21.html